reverse-engineer-anything

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

REA

Use REA when a claim depends on a shipped binary or package, decompilation, passive application runtime evidence, or comparison with behavior not established by available source. For ordinary analysis of a complete source repository, use normal repository tools and do not run REA readiness or provider commands.

当某项结论依赖于随产品交付的二进制文件或软件包、反编译结果、被动的应用程序运行时证据，或需要与现有源码尚未确立的行为进行比较时，使用 REA。对于完整源代码仓库的常规分析，使用常规仓库工具，不要运行 REA 就绪检查或 provider 命令。

Connect only when needed

仅在必要时连接

Installing this skill supplies instructions; it does not register the REA MCP server, install analysis engines, or add tools to an already-running agent.

If REA tools are available and their registration is not known to be stale, proceed directly to the target. Do not run diagnostics or setup before every investigation. Use the connected server's actual tool list and input schemas; a skill installed from repository main may describe capabilities absent from an older npm release. Keep complete inline Evidence when that server does not advertise retained references.

When tools are absent or registration is stale:

Diagnose without changing files. For Codex, run
```
npx -y rea-agents@latest doctor --client codex --json
```
. Substitute the current supported client:
```
claude_code
```
,
```
claude_desktop
```
,
```
codex
```
,
```
cursor
```
,
```
gemini_cli
```
,
```
windsurf
```
,
```
devin
```
,
```
opencode
```
,
```
antigravity
```
,
```
copilot_cli
```
,
```
commandcode
```
, or
```
vscode
```
. If the client is unknown, use
```
doctor --json
```
and inspect its registration results before choosing a setup scope.
Distinguish the reason. Missing, malformed, or stale registration needs a scoped configuration repair. An aligned registration with no tools in the active session needs a restart/reconnection; doctor cannot prove that the current agent has connected. A missing provider affects only tasks requiring that provider: static JavaScript inspection needs neither Hopper nor Ghidra, and Android inspection has separate bring-your-own JADX/Java prerequisites.
For a configuration repair, prepare the read-only plan:
```
npx -y rea-agents@latest setup --client codex --dry-run --json
```
. Use the current client's ID, show its exact proposed paths, backups, and changes, and obtain approval before setup writes configuration or installs Hopper. Setup normally installs the matching bundled skill too; include that replacement in the reviewed plan. After approval, apply the same scope with
```
npx -y rea-agents@latest setup --client codex --yes
```
. Add
```
--install-hopper
```
only if that separate installation was needed and explicitly approved.
Restart/reconnect the affected agent. Verify that REA tools actually appear in the session, then resume the original investigation. If they remain absent, inspect the client's MCP launch error rather than repeating setup.

REA setup never installs or upgrades Node.js, npm, Homebrew, Java, Ghidra, JADX, Binwalk, or Unblob. Use existing prerequisites; do not install unrelated software to repair MCP registration. For an unsupported client, use manual stdio registration with a version-pinned

rea-agents

package or continue through the CLI.

A concrete CLI fallback for an operator-supplied JavaScript tree or ASAR is:

bash

npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json

No MCP registration or native engine is required. Read the returned Evidence, graph, limitations, and unknowns with the same care as an MCP result; the CLI returns the Evidence record directly. This fallback does not establish that MCP is configured. Native CLI tasks still require their selected engine.

安装此 skill 只会提供说明；它不会注册 REA MCP server、安装分析引擎，也不会向已经运行的 Agent 添加工具。

如果 REA 工具可用，且其注册没有已知失效的迹象，请直接开始分析目标。不要在每次调查前运行诊断或 setup。以已连接 server 实际提供的工具列表和输入 schema 为准；从仓库 main 安装的 skill 可能描述了旧版 npm 发布版本中不存在的能力。当该 server 未声明支持保留引用时，请保留完整的内联 Evidence。

当工具缺失或注册已失效时：

在不修改文件的情况下进行诊断。对于 Codex，运行
```
npx -y rea-agents@latest doctor --client codex --json
```
。将 codex 替换为当前支持的 client：
```
claude_code
```
、
```
claude_desktop
```
、
```
codex
```
、
```
cursor
```
、
```
gemini_cli
```
、
```
windsurf
```
、
```
devin
```
、
```
opencode
```
、
```
antigravity
```
、
```
copilot_cli
```
、
```
commandcode
```
或
```
vscode
```
。如果 client 未知，使用
```
doctor --json
```
并在选择 setup 范围之前检查其注册结果。
区分具体原因。注册缺失、格式错误或已失效时，需要在限定范围内修复配置。注册配置正确但当前会话中没有工具时，需要重启或重新连接；doctor 无法证明当前 Agent 已连接。缺少 provider 只会影响需要该 provider 的任务：静态 JavaScript 检查既不需要 Hopper，也不需要 Ghidra；Android 检查则另有需要自行提供 JADX/Java 的前置条件。
如需修复配置，先准备只读方案：
```
npx -y rea-agents@latest setup --client codex --dry-run --json
```
。使用当前 client 的 ID，明确显示拟议的路径、备份和变更，并在 setup 写入配置或安装 Hopper 前获得批准。setup 通常也会安装匹配的 bundled skill；将该替换项纳入已审阅的方案。获得批准后，使用
```
npx -y rea-agents@latest setup --client codex --yes
```
应用相同范围。只有在确实需要单独安装 Hopper 且已明确批准时，才添加
```
--install-hopper
```
。
重启或重新连接受影响的 Agent。验证 REA 工具确实已出现在会话中，然后恢复原始调查。如果工具仍然缺失，应检查 client 的 MCP 启动错误，而不是重复 setup。

REA setup 从不安装或升级 Node.js、npm、Homebrew、Java、Ghidra、JADX、 Binwalk 或 Unblob。使用现有的前置条件；不要为修复 MCP 注册而安装无关软件。对于不受支持的 client，可使用带版本锁定的

rea-agents

包进行手动 stdio 注册，或继续通过 CLI 操作。

对于操作员提供的 JavaScript 目录树或 ASAR，可采用以下 CLI 回退方式：

bash

npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json

该方式不需要 MCP 注册或原生 engine。像处理 MCP result 一样谨慎读取返回的 Evidence、图谱、限制和未知项；CLI 会直接返回 Evidence record。该回退方式不能证明 MCP 已配置。原生 CLI 任务仍然需要选定的 engine。

Route the target first

首先根据目标选择工具

Choose the first tool from the target the user supplied. Use

open_binary

for active-target native or archive workflows; target-free tools take their own explicit path or endpoint and do not need it.

ASAR or extracted JavaScript/Electron tree:
```
analyze_javascript_application
```
.
Archive/package member inventory (ZIP/APK/IPA/MSIX/AppX or DMG):
```
open_binary
```
with the supplied local path; use
```
inspect_artifact
```
when its graph and findings help answer the question.
Android APK code, classes, methods, or incoming references:
```
inspect_android_package
```
, then focused Android tools when advertised. Archive member inventory still uses the archive route above.
Managed PE/CLI assembly:
```
inspect_managed_artifact
```
.
Firmware image:
```
inspect_firmware_regions
```
when advertised. Use
```
extract_firmware
```
when extraction is requested, with a caller-selected new absolute output directory. These tools use caller-supplied Binwalk/Unblob on Linux; see the firmware guide.
User-owned browser page already open:
```
list_browser_targets
```
.
User-owned Electron runtime already open:
```
list_electron_targets
```
.
Native executable, library, or analysis database:
```
open_binary
```
, then use focused analysis tools directly; call
```
binary_overview
```
when metadata or inventory context is useful.

If the app is missing, ask which app to inspect. Resolve a human-readable app name to one clear installed artifact when possible; ask only when matches are ambiguous. Never choose an example app on the user's behalf.

In a target-free session, use

open_binary

to bind any archive/package or native target whose analysis tool operates on the active target. Do not call an unadvertised tool; inspect

binary_session

with

{}

and its

result.tool_availability

for availability reasons and remediation. The tool list stays complete; availability depends on the operation, target, and host.

根据用户提供的目标选择第一项工具。对于围绕当前目标开展的原生或归档工作流，使用

open_binary

；无目标工具使用其自身显式指定的路径或端点，不需要先调用它。

ASAR 或解包后的 JavaScript/Electron 目录树：
```
analyze_javascript_application
```
。
归档/软件包成员清单（ZIP/APK/IPA/MSIX/AppX 或 DMG）：使用
```
open_binary
```
并传入给定的本地路径；当其图谱和发现结果有助于回答问题时，使用
```
inspect_artifact
```
。
Android APK 代码、类、方法或传入引用：先使用
```
inspect_android_package
```
，然后在工具列表提供时使用针对性的 Android 工具。归档成员清单仍应使用上述归档路径。
托管 PE/CLI 程序集：
```
inspect_managed_artifact
```
。
固件映像：在工具列表声明提供时使用
```
inspect_firmware_regions
```
。当请求提取时，使用
```
extract_firmware
```
，并指定由调用方选择的全新绝对输出目录。这些工具在 Linux 上使用调用方提供的 Binwalk/Unblob；请参阅固件指南。
用户自己已打开的浏览器页面：
```
list_browser_targets
```
。
用户自己已打开的 Electron 运行时：
```
list_electron_targets
```
。
原生可执行文件、库或分析数据库：先使用
```
open_binary
```
，然后直接使用针对性的分析工具；当元数据或清单上下文有帮助时，调用
```
binary_overview
```
。

如果找不到 app，请询问要检查哪个 app。尽可能将人类可读的 app 名称解析为一个明确的已安装制品；仅在匹配结果存在歧义时询问。绝不能替用户选择示例 app。

在无目标会话中，如果某个归档/软件包或原生目标的分析工具需要在当前目标上运行，请使用

open_binary

绑定该目标。不要调用未声明提供的工具；使用

{}

调用

binary_session

，并通过其

result.tool_availability

查看不可用原因和修复方法。工具列表始终保持完整；具体操作的可用性取决于操作、目标和主机。

Work summary-first

优先利用结果摘要

Start with the default result and use its inline Evidence and graph context. Do not repeat an identical tool call. Make a focused follow-up only when the returned result leaves a specific question unanswered.

Every conclusion must distinguish observations, inferences, and unknowns. Cite Evidence IDs, preserve limitations and incomplete coverage, and never imply that static analysis observed execution. Runtime requests execute the declared target and lifecycle; do not broaden the target or action beyond those fields.

Within the user's requested investigation, call available analysis tools directly. REA does not require permission grants or per-call approval flags. Follow the declared request scope and the host's actual access requirements.

先从默认结果入手，并使用其中的内联 Evidence 和图谱上下文。不要重复相同的工具调用。仅当返回结果留下了某个具体问题尚未回答时，才进行有针对性的后续调用。

每项结论都必须区分观察、推断和未知项。引用 Evidence ID，保留局限性和不完整的覆盖范围，绝不能暗示静态分析观察到了程序执行。运行时请求只执行声明的目标和生命周期；不得超出这些字段扩大目标或操作范围。

在用户请求的调查范围内，直接调用可用的分析工具。REA 不要求权限授权或逐次调用的批准标志。遵循已声明的请求范围以及主机的实际访问要求。

Plan broader investigations

规划更广泛的调查

For requests that span multiple features or subsystems, use a staged workflow:

Turn the request into a checklist of questions and the evidence each answer needs. Resolve target identity and constraints from the conversation and workspace before asking for information again.
Inspect the current REA session, artifact identity, saved analysis database, bookmarks, and prior evidence. Reuse matching state; do not open duplicate sessions or repeat identical analysis.
Start with the smallest useful overview or inventory. Follow each question from its entry point through relevant data and state changes to its result. Batch related operations around a specific hypothesis, then expand only when the returned evidence leaves a concrete gap.
Inspect relevant packaged resources and configuration alongside code when they affect the question. Use format-aware inventory and parsers; do not infer behavior from filenames, strings, or layout alone.
Corroborate a conclusion with the evidence type it requires. Use runtime observation only when static evidence cannot answer the question and the required host runtime and OS access are available. For JavaScript behavior, run probes against the actual app through the available browser, Electron, or process capture workflow.
Decompose work into independent questions. When parallel workers are available and the questions do not depend on one another, assign distinct scopes, point workers to existing evidence, and ask them to return sources, conclusions, and unresolved gaps. Otherwise, work sequentially.
Keep a concise finding ledger linking each conclusion to Evidence IDs, confidence/evidence type, search boundary, and remaining unknowns. Update the shared index or investigation report so later passes can reuse results.

Before finishing, revisit the original checklist. Mark each question as answered, partially answered, or unresolved based on its evidence; keep bounded negative searches bounded, and do not describe a broad investigation as complete while required questions remain open.

对于横跨多个功能或子系统的请求，采用分阶段工作流：

将请求转化为问题清单，并列出每个答案所需的证据。在再次询问信息之前，先从对话和工作区中确定目标身份和约束条件。
检查当前 REA 会话、制品身份、已保存的分析数据库、书签和既有证据。复用匹配的状态；不要打开重复会话，也不要重复相同的分析。
从最小但有用的概览或清单开始。针对每个问题，从入口点追踪相关数据和状态变化，直至得出结果。围绕一个具体假设批量执行相关操作，只有当返回的证据留下明确缺口时才扩大范围。
当打包资源和配置会影响问题时，应结合代码一并检查。使用格式感知的清单工具和解析器；不要仅凭文件名、字符串或目录布局推断行为。
使用结论所需的证据类型对其进行佐证。仅当静态证据无法回答问题，且具备所需的主机运行时和 OS 访问权限时，才使用运行时观察。对于 JavaScript 行为，应通过可用的浏览器、Electron 或进程捕获工作流，对实际应用运行探测。
将工作拆分为相互独立的问题。当并行 worker 可用且各问题互不依赖时，为它们分配不同范围，让 worker 指向既有证据，并要求返回来源、结论和未解决的缺口；否则按顺序执行。
维护一份简明的发现台账，将每项结论与 Evidence ID、置信度/证据类型、搜索边界和剩余未知项关联起来。更新共享索引或调查报告，以便后续阶段复用结果。

结束前，重新检查最初的问题清单。根据证据将每个问题标记为已回答、部分回答或未解决；限定范围的否定搜索仍应保持限定范围；在必要问题仍未解决时，不要将广泛调查描述为已完成。

Read only the relevant guide

仅阅读相关指南

Native binaries, managed assemblies, archives, and extraction: references/native-and-artifacts.md
ASARs, extracted JavaScript, feature tracing, and version comparison: references/javascript-applications.md
Android APK declarations, classes, methods, and static references: references/android-applications.md
Passive browser/Electron observation and static/runtime reconciliation: references/runtime-observation.md
Evidence paging, comparisons, residual unknowns, and verification: references/evidence-workflows.md

原生二进制文件、托管程序集、归档文件和提取： references/native-and-artifacts.md
ASAR、解包的 JavaScript、功能追踪和版本比较： references/javascript-applications.md
Android APK 声明、类、方法和静态引用： references/android-applications.md
浏览器/Electron 被动观察及静态/运行时核对： references/runtime-observation.md
Evidence 分页、比较、剩余未知项和验证： references/evidence-workflows.md

Finish the task

完成任务

Explain findings in plain language and tie them to returned evidence. When the user asks to build something, use normal coding tools and separate observed behavior from design choices. Close an opened native session with

close_binary

when the investigation is complete.

用通俗语言解释发现，并将结论与返回的证据关联起来。当用户要求构建某项内容时，使用常规编码工具，并将观察到的行为与设计选择区分开来。调查完成后，使用

close_binary

关闭已打开的原生会话。